ACH Contact Registry Noncompliance First Enforcement Began August 1
For more than a year, Nacha and the Payment Associations have been urging financial institutions large and small to fulfill their obligations and enter required information in the ACH Contact Registry. Nacha made clear that after an extended grace period, enforcement would begin Aug. 1.
It did.
“On Sept. 17, we had our first review of Registry non-compliance cases with the ACH Rules Enforcement Panel and the panel did impose fines related to these violations,” said Lorie Nash, Nacha Senior Director of Compliance.
Nine financial institutions were fined for Class 2 Rules violations. Seven of them are “access participants” in the ACH Network, which means they are not members of Payments Associations.
Under the Nacha Operating Rule that created the Registry, financial institutions using the ACH Network need to register contacts for ACH operations and fraud/risk management. The ACH Contact Registry is securely housed in Nacha’s Risk Management Portal. Financial institutions can also add contacts for optional categories, including checks, wires and debit cards. In all cases, individual or departmental contacts can be added, but the key is that any email addresses and phone numbers be monitored during normal business hours. The information also needs to be kept up to date.
The Registry opened July 1, 2020, and financial institutions were given four months from then, until Oct. 30, 2020, to register. However, Nacha did not treat failure to register as a Rules violation for an additional nine months, until Aug. 1, 2021.
How does Nacha find noncompliant financial institutions? It starts with the review of lists of active financial institutions from the Federal Deposit Insurance Corp. and the National Credit Union Administration.
“We just randomly pick out a bank or credit union, and then go into the Portal and search,” said Nash. “If they are compliant, we just mark it in the list ‘registered’ and we move on to another financial institution. It’s totally random. We’re not going alphabetically. We’re not going by routing number.”
Before contacting a financial institution about a possible violation, Nash’s team looks again, to see if it subsequently registered. “We check right down to the minute the letter is going to go out,” said Nash, reiterating that compliance is preferred over fines.
“Fine levels are meant to be symbolic, rather than punitive,” she said. “Our ultimate goal is compliance.”
To date, more than 39,000 contacts have been entered in the ACH Contact Registry, according to Jeanette A. Fox, Nacha Senior Director, Risk Investigations & ACH Network Risk Management.
“By registering—and keeping that information current—not only do you stay in compliance with Rules, but you also help a fellow bank or credit union that might one day need to get in touch with the right person at your organization,” said Fox.
The ACH Contact Registry is available only to registered financial institutions, Payments Associations and the two ACH Operators.
“Entering and updating your information should not be a heavy lift for any financial institution,” said Fox. “Financial institutions should also have procedures to ensure that their registration information stays up-to-date.”
And Nash had a word of warning to procrastinators: Spot checks continue, the ACH Rules Enforcement Panel meets monthly, and it could fine additional financial institutions for noncompliance.
More about the ACH Contact Registry can be found on the Rules section of Nacha.org.
Ready to enter your information on the ACH Contact Registry? Go to the Risk Management Portal.
For assistance, Nacha’s Portal support number is 703-349-4556, or email rmportal@nacha.org.